— RegulationTISAX : Automotive Information Security
No TISAX label, no market. Prepare your VDA ISA assessment and secure your position in the automotive supply chain.
Assessment levels
Max. preparation
Required in supply chain
Domains covered
TISAX (Trusted Information Security Assessment Exchange) is the information security standard specific to the automotive industry. Developed by the VDA (Verband der Automobilindustrie) and managed by the ENX Association, it is a prerequisite for market access for suppliers and subcontractors in the automotive industry.
Without a TISAX label, you cannot work with major manufacturers and OEMs. It is a non-negotiable commercial prerequisite. The assessment is based on the VDA ISA (Information Security Assessment) framework, covering information security, prototype protection, and, where applicable, personal data protection.
Assessment levels (AL1, AL2, AL3) determine the degree of rigor. For most suppliers, AL2 or AL3 is required — which entails an on-site audit by an accredited assessor.
What TISAX covers
Information security
Organizational and technical measures for confidentiality, integrity, and availability.
Prototype protection
Specific controls to secure information related to product development. Often the most demanding aspect.
Personal data protection
Governance of data processing where applicable.
Physical security
Access control for premises, sensitive areas, and development environments.
Why the supply chain is the weakest link
In the automotive industry, the supply chain is long and complex. A manufacturer can have thousands of Tier 1 suppliers, who themselves have thousands of subcontractors. Each link in the chain represents a potential risk for information security — particularly for prototype protection.
required in the auto supply chain
TISAX requires principals to ensure their suppliers meet security requirements. This means that even if you are not directly subject to TISAX, your clients may require you to be. And they increasingly do. Conitiv helps you assess your own VDA ISA maturity, score your subcontractors' cyber posture, and prepare for TISAX assessment.
How Conitiv helps you prepare for TISAX
VDA ISA questionnaire
Aligned with the TISAX framework. Self-assessment and supplier evaluation.
Gap analysis
Identification of your current level vs AL2/AL3 requirements. Targeted action plan.
Cyber rating of your subcontractors
Assess the security posture of your automotive supply chain.
Evidence-based audit
Document-based verification for suppliers with access to sensitive data.
ISO 27001 is a generic information security standard applicable to all sectors. TISAX is specific to the automotive sector and is based on the VDA ISA framework, which includes additional requirements for prototype protection. TISAX incorporates ISO 27001 principles but adapts and supplements them for the automotive industry.
The required level depends on the nature of the information you handle. AL2 (standard assessment) is sufficient for highly confidential information. AL3 (in-depth assessment with on-site verification) is required for prototype protection or highly sensitive information. Your principals generally specify the expected level.
Allow 3 to 9 months of preparation depending on your maturity level, then 1 to 3 months for the assessment itself. Conitiv's self-assessment enables you to quickly identify gaps and accelerate preparation.
Ready to prepare your TISAX assessment?
expert Conitiv